Khaled Alenazi

The Notification Bar for WordPress plugin through 1.1.8 exposes an unauthenticated CSV export script that discloses all stored subscriber emails.

The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component

**Name of the Vulnerable Software and Affected Versions** Advanced Custom Fields: Extended WordPress plugin versions prior to 0.9.2.7 **Description** The front-end Forms module fails to verify if the requester is authorized to edit a targeted user account during the `update-user` action. The plugin only performs capability checks when the submitted role is administrator or super admin. If a publicly accessible front-end form is configured to target an administrator account and maps the password to a visitor-submitted field, an unauthenticated visitor can overwrite the administrator's password to take over the account. By default, the action targets the submitting user, meaning exploitation requires the form to be specifically configured to target another account. **Recommendations** Update Advanced Custom Fields: Extended WordPress plugin to version 0.9.2.7 or later.

The Auto x LINE WordPress plugin through 1.0.0 does not have authorization checks in some of its REST endpoints, allowing unauthenticated users to call them and update the plugin settings, clear logs etc

**Name of the Vulnerable Software and Affected Versions** MemberHero WordPress plugin versions prior to 7.0 **Description** The plugin fails to restrict account fields during the frontend registration process. This allows unauthenticated attackers to register a new user with an arbitrary role, such as Administrator, which can lead to a full site takeover and the compromise of existing accounts. **Recommendations** Deactivate and remove the plugin versions prior to 7.0 until a version that fully resolves this issue is released. Disable public registration and restrict access to the registration functionality. Monitor the site for unexpected administrator accounts.

**Name of the Vulnerable Software and Affected Versions** WP Social Media Login versions prior to 1.0.7 **Description** The WP Social Media Login WordPress plugin fails to verify if a social login process was successfully completed with the identity provider before authenticating a visitor. This allows unauthenticated attackers to gain access to any existing user account, including those with administrator privileges, by providing the target user's email address. **Recommendations** Update WP Social Media Login to version 1.0.7 or later.

**Name of the Vulnerable Software and Affected Versions** Social Login & Sharing buttons with Analytics By SoClever versions prior to 1.2.1 **Description** The plugin fails to perform authentication, authorization, or nonce checks in a publicly accessible login handler. This allows unauthenticated attackers to obtain a valid session for any existing user, including administrators. By default, an attacker can gain a session as the site's original administrator account without requiring any account details. **Recommendations** Update Social Login & Sharing buttons with Analytics By SoClever to a version newer than 1.2.0.

**Name of the Vulnerable Software and Affected Versions** SmilePass Selfie Login versions prior to 1.0.3 **Description** The SmilePass Selfie Login WordPress plugin fails to perform server-side verification of the identity during the authentication process. This flaw allows unauthenticated users to bypass authentication and log in as any registered account, including those with administrator privileges. **Recommendations** Update SmilePass Selfie Login to a version newer than 1.0.2.

**Name of the Vulnerable Software and Affected Versions** Dokan: AI Powered WooCommerce Multivendor Marketplace Solution versions prior to 5.0.14 **Description** Insufficient user capability checks on certain admin REST API routes allow users with Shop Manager privileges to install and activate arbitrary plugins from WordPress.org. The system incorrectly verifies only for a general WooCommerce management capability instead of the required installation capability. **Recommendations** Update to version 5.0.14 or later.

**Name of the Vulnerable Software and Affected Versions** JSON Options versions prior to 0.0.5 **Description** The JSON Options WordPress plugin lacks capability checks and nonce verification on an action that executes on every request. This allows unauthenticated users to update arbitrary WordPress options. An attacker can exploit this to enable user registration and set the default role to administrator, resulting in privilege escalation and full site takeover. **Recommendations** Update JSON Options to a version newer than 0.0.4.

**Name of the Vulnerable Software and Affected Versions** Subscriptions for WooCommerce versions prior to 2.0.1 **Description** An issue exists where the software fails to verify user capabilities before installing and activating a plugin from a user-supplied slug via a nonce-protected AJAX action. This allows users with the Shop Manager role, who lack the necessary management capabilities, to install and activate arbitrary plugins, which can lead to remote code execution. **Recommendations** Update Subscriptions for WooCommerce to version 2.0.1 or later.

**Name of the Vulnerable Software and Affected Versions** ChamaWP versions prior to 1.0.13 **Description** Insufficient validation of user input before it is processed by a PHP deserialization function allows unauthenticated attackers to inject arbitrary PHP objects. This can lead to remote code execution if a suitable gadget chain—a sequence of existing code fragments that can be leveraged for malicious purposes—is present within the installed environment. **Recommendations** Update ChamaWP to version 1.0.13 or later.

**Name of the Vulnerable Software and Affected Versions** Webinfos WordPress plugin versions prior to 1.3 **Description** The plugin fails to validate the type or name of uploaded files and does not restrict the upload action with authentication, capability, or nonce checks. This allows unauthenticated attackers to upload arbitrary files, such as PHP scripts, to a web-accessible directory. On servers that execute PHP from the uploads path, this can lead to remote code execution. **Recommendations** Update the Webinfos WordPress plugin to a version newer than 1.2.

**Name of the Vulnerable Software and Affected Versions** POUCO Import Users versions prior to 1.0.1 **Description** The POUCO Import Users WordPress plugin fails to perform capability or nonce checks on AJAX actions available to unauthenticated users used for creating and updating WordPress accounts. Additionally, the plugin trusts a role value supplied by the user, which allows an unauthenticated attacker to create a new administrator account and gain full control of the site. **Recommendations** Update POUCO Import Users to a version newer than 1.0.0.

**Name of the Vulnerable Software and Affected Versions** login-social WordPress plugin versions prior to 1.0.5 **Description** This issue occurs because the plugin fails to validate password-reset requests against a reset key or the identity of the requester. Additionally, it generates authentication sessions based on unverified third-party sign-in data. This allows unauthenticated attackers to reset passwords for any user or log in as any existing account, including those with administrator privileges, leading to full site takeover. **Recommendations** Update the login-social WordPress plugin to version 1.0.5 or later.

**Name of the Vulnerable Software and Affected Versions** Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress versions prior to 5.2.1 **Description** An arbitrary file upload issue exists due to missing file type validation in the upload function. The WPL I/O service endpoint is registered on the public WordPress init hook without a capability check and relies on static, plugin-seeded API credentials (`api key` and `api secret`) that are identical across all installations. This allows unauthenticated attackers to upload executable files, potentially leading to remote code execution. **Recommendations** Update the plugin to a version later than 5.2.0. As a temporary mitigation, restrict access to the WPL I/O service endpoint.

**Name of the Vulnerable Software and Affected Versions** MainWP Child WordPress plugin versions prior to 6.1.2 **Description** The site-registration request handler fails to verify the identity of the requester when password authentication is disabled for the targeted account. This allows an unauthenticated attacker to obtain a valid authentication session for that account, including those with administrator privileges, by specifying the login name in a single registration request. **Recommendations** Update the MainWP Child WordPress plugin to version 6.1.2 or later.

**Name of the Vulnerable Software and Affected Versions** miniOrange OTP Login, Verification and SMS Notifications versions prior to 5.5.2 **Description** An authentication bypass exists that allows for administrator account takeover. The issue occurs because the `um reset password process hook()` function fails to perform server-side verification to ensure the OTP validation step was completed. Instead, it relies on a public `form nonce` nonce emitted to unauthenticated visitors via the `moumprvar` JavaScript object on the Ultimate Member password reset page. An unauthenticated attacker can provide a controlled `username b` parameter to target any WordPress user, regardless of role, without a validated OTP session. This allows the attacker to obtain a password-reset URL in a 302 `Location` header and gain full control of the account. This requires the Ultimate Member Password Reset Form integration to be active and the plugin to not be configured for phone-only reset. **Recommendations** Update the plugin to a version newer than 5.5.1. As a temporary mitigation, disable the Ultimate Member Password Reset Form integration or configure the plugin for phone-only reset.

**Name of the Vulnerable Software and Affected Versions** Advanced Form Integration — Connect Forms to 200+ Apps WordPress plugin versions prior to 2.1.1 **Description** An issue exists where the plugin fails to restrict the WordPress role assigned during user creation from public form submissions. When a non-default configuration is active and an integration maps the user role to a public form field, unauthenticated visitors can create an account with administrator privileges. **Recommendations** Update Advanced Form Integration — Connect Forms to 200+ Apps WordPress plugin to version 2.1.1 or later.

**Name of the Vulnerable Software and Affected Versions** AI Copilot WordPress plugin versions prior to 1.5.4 **Description** The plugin fails to bind OAuth access tokens to a specific WordPress user. Consequently, the system accepts any valid token as an administrator session. This allows unauthenticated attackers who complete the public OAuth flow to execute privileged MCP tools with administrator privileges, enabling actions such as arbitrary user creation and role escalation. **Recommendations** Update the AI Copilot WordPress plugin to version 1.5.4 or later.